Hi John,
What I do in these cases is I have and ip file called
IP_FILE_SUSPICIOUS_NETWORK
(scored 25% of delete weight)
slap this network in there and if it re-occurs I move it to IP_FILE_NETWORK
(scored 40% of delete weight.)
I have the same scenario for the actual hosts themselves -
IP_FILE_SUSPICIOUS_HOSTS
(scored 25% of delete weight)
IP_FILE_HOSTS
(scored 40 % of delete weight.)
-Nick
----- Original Message ----- From: "John Carter" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Tuesday, November 15, 2005 12:51 PM
Subject: [Declude.JunkMail] Blocking on resolved domain name
I am getting a lot of spam for 64.192.25.* (which come in with
constantly
changing domains, but actually resolve back to
outgoing.liverandcherrys.com). I am reluctant to block the whole
class C,
but will likely end up doing so. Is there a better way to handle this?
Kind of a "best practices"?
John
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
